Abstract: An improved tunnel encapsulation method was proposed ba sed on the analysis of the mechanism of Internet network layer security protocol IPSec. On the basis of encapsulating the original IP address of the host in the data packet and doing corresponding management of it at the opponent side and s olving the incompatibility problem between IPSec and NAT the two sides of t he communication can still configure their security policy flexibly. Compared wi th the solution method of Internet engineering task force, our method can keep t he flexibility of security policy configuration without the loss of security and with adding a little spending.

Key words: security of Network, IPSec, NAT, encapsulation of UDP